Diagnostic framework in computing systems

ABSTRACT

Various techniques for diagnostics, troubleshooting, and root-cause analysis are disclosed herein. In one embodiment, a method includes receiving operational data from a computing system and identifying an operational pattern based on the operational data. The operational pattern includes a temporal sequence of operations, events, or system states related to the computing system. The method also includes receiving an annotation and associating the received annotation with the identified operational pattern. The annotation identifies a reason, a cause, or a corrective suggestion corresponding to a violation of the temporal sequence.

CROSS-REFERENCE TO RELATED APPLICATION(S)

This application is a continuation of and claims priority to U.S. patentapplication Ser. No. 14/829,860, filed on Aug. 19, 2015.

BACKGROUND

Cloud computing typically utilizes a group of virtual machines or otherremote servers to process, manage, or store user data. A communicationsnetwork can interconnect the remote servers to form a computing fabric.During operation, one or more remote servers of the computing fabric cancooperate with one another to provide a distributed computingenvironment that facilitates execution of various user softwareapplications and provide other computing services.

SUMMARY

This Summary is provided to introduce a selection of concepts in asimplified form that are further described below in the DetailedDescription. This Summary is not intended to identify key features oressential features of the claimed subject matter, nor is it intended tobe used to limit the scope of the claimed subject matter.

In certain cloud computing environments, a cloud service provider canprovide computing facilities (e.g., tenant sites) to multiple users ortenants to execute user software applications. One difficulty of thisarrangement is that the cloud service provider typically has no accessto operating parameters, event logs, performance metrics, or otheroperational data of the individual tenant sites. Thus, the cloud serviceprovider may not have sufficient information to diagnose, troubleshoot,or perform root-cause analysis of operational issues when tenantsexperience service outage, performance degradation, or other operationalissues.

Several embodiments of the disclosed technology provide a diagnosticsystem and framework that enables tenants or a cloud service provider toefficiently diagnose, troubleshoot, or perform root-cause analysis ofoperational issues of a tenant site or the computing fabric supportingthe tenant site. In certain embodiments, the diagnostic system caninclude an analysis component, an augmentation component, and aninterpretation component operatively coupled to one another. Theanalysis component can be configured to examine historical and/orreal-time operational data of a tenant site or at least a portion of acomputing fabric. Through examination, the diagnostic system canrecognize operational patterns (e.g., sequences of states or events) orcorrelate certain performance metrics (e.g., cache data size, networktraffic volume, etc.) under normal operating conditions. Theaugmentation component can be configured to receive annotations from,for example, developers or administrators of the computing fabric ortenant site. The annotations can include possible reasons, causes, orpredictions that resulted in a violation of an operational pattern orcorrelation of performance metrics under normal operating conditions.The annotated operational patterns and/or correlations of performancemetrics can then form operational profiles.

The interpretation component can be configured to utilize theoperational profiles to determine if any of the operational patterns orcorrelations of performance metrics are violated during operation. Inresponse to determining that one of the operational patterns or one ofthe correlations of performance metrics is violated, the interpretationcomponent can be configured to determine a reason, a possible cause, ora prediction associated with the violation based on the annotations inthe operational profiles. The interpretation component can alsocorrelate periods of violations with periods of operational issuesexperienced by a tenant. As such, the diagnostic system can efficientlyand automatically identify possible reasons, causes, or predictionscorresponding to operational issues experienced by tenants. In otherembodiments, the interpretation component can also be configured toprovide mitigation suggestions, automatic operational adjustments,and/or perform other suitable operations based on the identifiedpossible reasons, causes, or predictions.

BRIEF DEROUTINEION OF THE DRAWINGS

FIG. 1 is a schematic diagram illustrating a computing framework havinga diagnostic system configured in accordance with embodiments of thedisclosed technology.

FIG. 2 is a block diagram showing software components suitable for thediagnostic system of FIG. 1 and in accordance with embodiments of thedisclosed technology.

FIGS. 3 and 4 are block diagrams showing example software modulessuitable for the analysis component and interpretation component of FIG.2, respectively, in accordance with embodiments of the disclosedtechnology.

FIG. 5 is a flow diagram illustrating embodiments of a process ofperforming operational diagnostics in accordance with embodiments of thedisclosed technology.

FIG. 6 is a flow diagram illustrating embodiments of a process ofgenerating operational patterns in accordance with embodiments of thedisclosed technology.

FIG. 7 is a flow diagram illustrating embodiments of a process ofperforming interpretation of operational data in accordance withembodiments of the disclosed technology.

FIG. 8 is a schematic diagram illustrating an example operationalpattern in accordance with embodiments of the disclosed technology.

FIG. 9 is a schematic diagram illustrating an example graph ofperformance metrics in accordance with embodiments of the disclosedtechnology.

FIG. 10 is a schematic diagram illustrating an example operationalpattern with augmented annotations in accordance with embodiments of thedisclosed technology.

FIGS. 11A-11C are schematic diagrams illustrating an example correlationof operational issues with system health levels in accordance withembodiments of the disclosed technology.

FIG. 12 is a computing device suitable for certain components of thecomputing framework in FIG. 1.

DETAILED DEROUTINEION

Certain embodiments of systems, devices, components, modules, routines,and processes for diagnostics, troubleshooting, or root-cause analysisin computing systems are described below. In the following description,specific details of components are included to provide a thoroughunderstanding of certain embodiments of the disclosed technology. Aperson skilled in the relevant art will also understand that thedisclosed technology may have additional embodiments or may be practicedwithout several of the details of the embodiments described below withreference to FIGS. 1-12.

As used herein, the term “computing fabric” generally refers to acomputing system having a plurality of nodes interconnected by acommunications network in a “weave” or other suitable configurations. A“node” in a computing fabric generally refers to a computing element. Incertain embodiments, a computing element can include a physical serverwith one or more computing processors, memory devices, and/orperipherals. In other embodiments, a computer element can include avirtual machine or other suitable virtualized entities with virtualizedprocessor, memory, and/or storage devices. A physical computer networkand/or one or more virtual computer networks can interconnect nodes of acomputing fabric.

Also used herein, the term “tenant site” generally refers to adistributed computing environment provided by a computing fabric thatfacilitates execution of various user software applications in order toprovide computing services to a user or tenant. A tenant site can behosted on one or more nodes of the computing fabric and may be movableamong nodes of the computing fabric. In certain embodiments, a tenantsite can include one or more virtual machines. In other embodiments, atenant site can include virtual network controllers and/or othersuitable components.

As used herein, the term “operational patterns” generally refers to atemporal sequence of operations observed at, for example, a tenant site.For example, one operational pattern can include a sequence of receivinga user query, searching a database based on the user query, andtransmitting a response to the user query. Optionally, operationalpatterns can also include time intervals between each pair of thesequence of operations. In the foregoing example, the operationalpattern can also include a first time interval (e.g., 20 milliseconds)between receiving the user query and searching the database and a secondtime interval (e.g., 1 second) between searching the database andtransmitting the response.

Also used herein, the term “performance metrics” generally refers to oneor more operating parameters each corresponding to a performance levelof a computing system. Example performance metrics can include a size ofavailable memory, a data cache size, a network utilization percentage, anumber of service requests over a period of time, etc. A performancemetric may be correlated with one or more other performance metrics. Incertain embodiments, a correlation coefficient may be computed for apair of performance metrics. The correlation coefficient can have values(e.g., −1 to 1) to indicate if a pair of performance metrics iscorrelated (e.g., with a value approximately 1) or not correlated (e.g.,with a value approximately −1). In other embodiments, pairs of theperformance metrics may be correlated in other suitable manners.

As used herein, “annotation” to an operational pattern or correlation ofperformance metrics generally refers to input received from, forexample, developers or administrators of the computing fabric or atenant site. In certain embodiments, an annotation can include possiblereasons, causes, or predictions when a particular operational pattern orcorrelation of performance metrics is violated. In other embodiments, anannotation can also include suggested mitigation or correction actionsfor the violation. For instance, an annotation may be added to theoperational pattern in the example above that a database server isoffline if searching the database is not performed within a periodsubsequent to receiving the user query. Also used herein, the term“operational profile” generally refers to data records of operationalpatterns and/or correlations of performance metrics with correspondingannotations.

In certain cloud computing environments, a cloud service provider canprovide tenants distributed computing facilities, or tenant sites toprovide desired computing services. However, the cloud service providertypically has no access to event logs, performance metrics, or otheroperational data at the individual tenant sites because the tenants havecontrol over the corresponding tenant sites. Thus, the cloud serviceprovider may not have sufficient or any information to diagnose,troubleshoot, or perform root-cause analysis of operational issues whena tenant requests the cloud service provider's help for service outagesor other operational issues. Several embodiments of the disclosedtechnology can provide a diagnostic system and framework that enablestenants or cloud service providers to efficiently diagnose,troubleshoot, or perform root-cause analysis of operational issues, asdescribed in more detail below.

FIG. 1 is a schematic diagram illustrating a computing framework 100having a diagnostic system configured in accordance with embodiments ofthe disclosed technology. As shown in FIG. 1, the computing framework100 can include client devices 102 (identified individually as first andsecond client devices 102 a and 102 b, respectively), a computing fabric104, and a diagnostic system 108 interconnected by a computer network103. The computer network 103 can include the Internet, a local areanetwork, a metropolitan area network, a wide area network, and/or othersuitable types of network. Particular components of the computingframework 100 are illustrated in FIG. 1 for illustration purposes. Inother embodiments, the computing framework 100 can also includeadditional and/or different computing, networking, or other suitabletypes of components.

The client devices 102 can each include a desktop, a laptop, a tablet, asmartphone, and/or other suitable types of computing device. Forexample, as shown in FIG. 1, the first client device 102 a can include adesktop computer. The second client device 102 b can include a laptopcomputer. In other embodiments, the client device 102 may also includeother suitable hardware and/or software components. In any of theforegoing embodiments, the client devices 102 can facilitate users ortenants 101 (identified individually as first and second tenants 101 aand 101 b, respectively) to access corresponding tenant sites 142provided by the computing fabric 104, as described in more detail below.

As shown in FIG. 1, the computing fabric 104 can include multipleservers 106 (identified individually as first and second servers 106 aand 106 b, respectively) each having a processor 132, a memory 134, andan input/output component 136 operatively coupled to one another. Theprocessor 132 can include a microprocessor, a field-programmable gatearray, and/or other suitable logic devices. The memory 134 can includevolatile and/or nonvolatile media (e.g., ROM; RAM, magnetic disk storagemedia; optical storage media; flash memory devices, and/or othersuitable storage media) and/or other types of computer-readable storagemedia configured to store data received from, as well as instructionsfor, the processor 132. The input/output component 136 can be configuredto accept input from and provide output to an operator and/or anautomated software controller (not shown).

The first and second servers 106 a and 106 b can individually containinstructions in the memory 134 that when executed by the processors 132,cause the individual processors 132 to provide a hypervisor 140(identified individually as first and second hypervisors 140 a and 140b) and an operation monitor 141 (identified individually as first andsecond operation monitors 141 a and 141 b). The hypervisors 140 andoperation monitors 141 are shown in FIG. 1 as software components.However, in other embodiments, the hypervisors 140 and/or the operationmonitors 141 can also include firmware and/or hardware components. Eventhough the hypervisor 140 and the operation monitor 141 are shown asseparate components in FIG. 1, in other embodiments, the operationmonitor 141 can be a part of the hypervisor 140 or an operating system(not shown) executing on the corresponding first or second server 106 aand 106 b.

The hypervisors 140 can individually be configured to generate, monitor,terminate, and/or otherwise manage one or more virtual machines 144organized into tenant sites 142. For example, as shown in FIG. 1, thefirst server 106 a can provide a first hypervisor 140 a that managesfirst and second tenant sites 142 a and 142 b, respectively. The secondserver 106 b can provide a second hypervisor 140 b that manages firstand second tenant sites 142 a′ and 142 b′, respectively. The tenantsites 142 can each include multiple virtual machines 144 associated withparticular tenants 101. For example, the first server 106 a and thesecond server 106 b can both host the tenant site 142 a and 142 a′ forthe first tenant 101 a, and the tenant site 142 b and 142 b′ for thesecond tenant 101 b. Each virtual machine 144 can be executing acorresponding operating system, middleware, and/or applications.

Also shown in FIG. 1, the computing fabric 104 can also include one ormore virtual networks 146 that interconnect the tenant sites 142 a and142 b across multiple hosts 106. For example, a first virtual network142 a interconnects the first tenant sites 142 a and 142 a′ at the firstand second servers 106 a and 106 b. A second virtual network 146 binterconnects the second tenant sites 142 b and 142 b′ at the first andsecond servers 106 a and 106 b. Even though a single virtual network 146is shown as corresponding to one tenant site 142, in other embodiments,multiple virtual networks 146 (not shown) may be configured tocorrespond to a single tenant site 146.

The operation monitors 141 can be configured to monitor for operationaldata 112 of respective tenant sites 142 and/or the computing fabric 104.In certain embodiments, the operational data 112 can include operationalpatterns and/or performance metrics of the tenant sites 142 or thecomputing fabric 104. For example, the operational data 112 can includealarm logs, event logs, operating reports, and/or other suitable datafrom the tenant sites 142 and/or the computing fabric 104. In certainembodiments, the operation monitors 141, the hypervisors 140, or othersuitable components of the servers 106 can also store previouslyacquired operational data 112 as historical data 116, for instance, inthe memory 134 of the servers 106. The historical data 116 can then beprovided to the diagnostic system 108 for offline analysis. In otherembodiments, the operation monitors 141 can be configured to transmitthe operational data 112 to the diagnostic system 108 for onlineanalysis and/or monitoring. Based on the operational data 112 and/or thehistorical data 116, the diagnostic system 108 can be configured togenerate operational profiles and monitor operations of the tenant sites142 and/or the computing fabric 104, as described in more detail below.

As shown in FIG. 1, the diagnostic system 108 can include a processor142, a memory 144, and an input/output component 146 operatively coupledto one another. The processor 142 can include a microprocessor, afield-programmable gate array, and/or other suitable logic devices. Thememory 144 can include volatile and/or nonvolatile media (e.g., ROM;RAM, magnetic disk storage media; optical storage media; flash memorydevices, and/or other suitable storage media) and/or other types ofcomputer-readable storage media configured to store data received from,as well as instructions for, the processor 142 (e.g., instructions forperforming the methods discussed below with reference to FIGS. 5-7). Theinput/output component 136 can include a display, a touch screen, akeyboard, a mouse, a printer, and/or other suitable types ofinput/output devices configured to accept input from and provide outputto an operator and/or an automated software controller (not shown).

The diagnostic system 108 can be configured to perform analysis of theoperational data 112 and/or historical data 116 on an offline or onlinebasis. In one embodiment, the diagnostic system 108 can parse theoperational data 112 and recognize operational patterns of the tenantsites 142 and/or the computing fabric 104. One example operationalpattern is described in more detail with reference to FIG. 8. In anotherembodiment, the diagnostic system 108 can obtain performance metricsfrom the operational data 112 and compute correlation coefficients forthe performance metrics. One example correlation of performance metricsis described in more detail with reference to FIG. 9. In furtherembodiments, the diagnostic system 108 can also be configured to performa combination of the foregoing analysis and/or other suitable analysis.

The diagnostic system 108 can also be configured to receive annotationsfor one or more of the recognized operational patterns or correlationsof performance metrics. An annotation can be associated with eachoperation in an operational pattern or a group of operations in anoperational pattern. Similarly, an annotation can be associated with oneor more correlations of performance metrics. One example of receivingannotations for an operational pattern is described in more detail withreference to FIG. 10. The operational patterns and correlations ofperformance metrics can then be stored with corresponding annotations asperformance profiles in, for example, a database 110 (shown in FIG. 2).

The diagnostic system 108 can also be configured to monitor operationsof the tenant sites 142 and/or the computing fabric 104 based on thegenerated performance profiles. For example, in certain embodiments, thediagnostic system 108 can receive and perform analysis on additionaloperational data 112 to recognize one or more additional operationalpatterns and/or correlations of performance metrics. The diagnosticsystem 108 can then compare the additional operational patterns and/orcorrelations of performance metrics with those in the performanceprofiles.

Based on the comparison, the diagnostic system 108 can also determineand/or quantify a health level of the tenant sites 142 or the computingfabric 104. For example, in one embodiment, a first quantity (e.g., 100)of user queries can be received in a period. If a second quantity (e.g.,99) of the received user queries are processed according to operationalpatterns that are generally similar to those in the performanceprofiles, the diagnostic system 108 can be configured to calculate ahealth level (e.g., 99%) based on the first and second quantities.

Upon determining a current health level, in certain embodiments, thediagnostic system 108 can be configured to raise an alarm or generate anevent log if the current health level falls below a threshold. Forexample, the diagnostic system 108 can generate an email, text message,or other suitable messages reporting the violations and/or health levelto an administrator. In other embodiments, the diagnostic system canalso be configured to provide suggestions of corrective actions asresults 114 for mitigating the violations or improving the health levelbased at least in part on the annotations associated with theoperational patterns and/or correlations of performance metrics. Forexample, the results 114 can include a suggestion that a networkbandwidth allocated to a tenant 101 be increased, more memory space beallocated to a particular virtual machine 144 or tenant site 142, and/orother suitable actions.

In further embodiments, the diagnostic system 108 can be configured toconduct a root-cause analysis based on reported operational issues andthe observed violations. In one embodiment, the diagnostic system 108can be configured to aggregate operational issues (e.g., requesttimeout, cache server unavailable, etc.) over a period to generate anoperational issue timeline. The diagnostic system 108 can also beconfigured to aggregate the observed violations over the same period togenerate a system issue timeline. The diagnostic system 108 can thenalign, juxtapose, or compare the generated operational issue timelinewith the system issue timeline to correlate observed operational issueswith violations. Upon identification of violations correlated to theoperational issues, the diagnostic system 108 can be configured todetermine a root-cause related to the observed operational issues and/orprovide mitigation suggestions based on the annotations associated withthe violations. One example of root-cause analysis is described in moredetail below with reference to FIGS. 11A-11C.

In yet further embodiments, the diagnostic system 108 can also beconfigured to predict a deterioration, restoration, repetition, or otherfuture conditions of operations of the tenant sites 142 and/or thecomputing fabric 104. For example, in one embodiment, the diagnosticsystem 108 can predict that a network or server failure is imminentbased on a violation of an operational pattern or correlation ofperformance metrics. In another embodiment, the diagnostic system 108may also predict that operation is likely to return to normal despite ofthe detected violation. In yet further embodiments, the diagnosticsystem 108 can be configured to automatically adjust operations of thetenant sites 142 and/or operations of the computing fabric 104. Forexample, the diagnostic system 108 can be configured to request a fabriccontroller (not shown) of the computing fabric 104 to allocateadditional network bandwidth, memory space, or other resources to aparticular tenant site 142.

In operation, the tenants 101 can individually access computingfacilities at corresponding tenant sites 142 with the client devices 102via the computer network 103. During operation, the operation monitors141 or other suitable components of the computing fabric 104 can acquireand/or record operational data 112. The operational data 112 or anypreviously acquired historical data 116 can be provided to thediagnostic system 108 for analysis. In certain embodiments, thediagnostic system 108 can perform an offline analysis of the historicaldata 116 to generate performance profiles as described above. In otherembodiments, the diagnostic system 108 can perform an online analysis ofoperational data 112 to generate the performance profiles. In furtherembodiments, the diagnostic system 108 can also perform additionalonline or offline analysis of the operational data 112 to update and/orotherwise modify the performance profiles on a continuous or periodicalbasis. The diagnostic system 108 can then perform operational monitoringof the tenant sites 142 and/or computing fabric 104 based on thegenerated performance profiles, as described above.

Even though the diagnostic system 108 is shown as being separate fromthe computing fabric 104 in FIG. 1, in other embodiments, the diagnosticsystem 108 can be a part of the computing fabric 104. For example, thediagnostic system 108 can be hosted on one or more of the servers 106 inthe computing fabric 104. In further embodiments, the diagnostic system108 can also be a part of the tenant sites 142 or the hypervisors 140.Further, the memory 144 of the diagnostic system 108 can containinstructions that when executed by the processor 142, cause theprocessor 142 to provide various software components for performing oneor more of the foregoing functions of the diagnostic system 108. Oneexample of such software components is described in more detail withreference to FIG. 2.

FIG. 2 is a block diagram showing software components suitable for thediagnostic system of FIG. 1 and in accordance with embodiments of thedisclosed technology. In FIG. 2 and in other Figures herein, individualsoftware components, objects, classes, modules, and routines may be acomputer program, procedure, or process written as source code in C,C++, Java, and/or other suitable programming languages. A component mayinclude, without limitation, one or more modules, objects, classes,routines, properties, processes, threads, executables, libraries, orother components. Components may be in source or binary form. Componentsmay include aspects of source code before compilation (e.g., classes,properties, procedures, routines), compiled binary units (e.g.,libraries, executables), or artifacts instantiated and used at runtime(e.g., objects, processes, threads).

Components within a system may take different forms within the system.As one example, a system comprising a first component, a secondcomponent and a third component can, without limitation, encompass asystem that has the first component being a property in source code, thesecond component being a binary compiled library, and the thirdcomponent being a thread created at runtime. The computer program,procedure, or process may be compiled into object, intermediate, ormachine code and presented for execution by one or more processors of apersonal computer, a network server, a laptop computer, a smartphone,and/or other suitable computing devices. Equally, components may includehardware circuitry. A person of ordinary skill in the art wouldrecognize that hardware may be considered fossilized software, andsoftware may be considered liquefied hardware. As just one example,software instructions in a component may be burned to a ProgrammableLogic Array circuit, or may be designed as a hardware circuit withappropriate integrated circuits. Equally, hardware may be emulated bysoftware. Various implementations of source, intermediate, and/or objectcode and associated data may be stored in a computer memory thatincludes read-only memory, random-access memory, magnetic disk storagemedia, optical storage media, flash memory devices, and/or othersuitable computer readable storage media excluding propagated signals.

As shown in FIG. 2, the processor 142 of the diagnostic system 108 caninclude an analysis component 152, an augmentation component 154, and aninterpretation component 156 operative coupled to one another. Eventhough particular components of the processor 142 are shown in FIG. 2,in other embodiments, the processor 142 can also include input/output,networking, communications, and/or other suitable types of components.In further embodiments, at least one of the analysis, augmentation, orthe interpretation component 152, 154, and 156 can be provided by otherprocessing components (e.g., virtual machines 144 in FIG. 1) than theprocessor 142 of the diagnostic system 108.

As shown in FIG. 2, the analysis, augmentation, or the interpretationcomponent 152, 154, and 156 can also be operatively coupled to adatabase 110 containing records of operational profiles 122. In oneembodiment, the database 110 can reside in the memory 144 (FIG. 1) ofthe diagnostic system 108. In other embodiments, the database 110 can bereside in a network storage server (not shown) and/or other suitablestorage components of the computing fabric 104 (FIG. 1) or an externalcomputing system.

As shown in FIG. 2, the analysis component 152 can be configured toreceive and process the operational data 112 and/or the historical data116 related to a tenant site 142 (FIG. 1) or at least a portion of acomputing fabric 104. In certain embodiments, the analysis component 152can be configured to recognize certain computing, network, or othersuitable types of operations contained in the operational data 112and/or the historical data 116 based on, for example, user input 117(shown in FIG. 3) containing a list of operational types. Based on therecognized operations, the analysis component 152 can then determine oneor more sequences of the operations as well as time intervalstherebetween.

In other embodiments, the analysis component 152 can also be configuredto recognize one or more performance metrics contained in theoperational data 112 and/or the historical data 116. The analysiscomponent 152 can then determine one or more correlation values betweenpairs of the performance metrics. Based on the correlation values, theanalysis component 152 can indicate whether a first operational metric(e.g., an available memory size) is correlated or not correlated to asecond operational metric (e.g., a cache data size). The analysiscomponent 152 can then provide the determined one or more sequences ofoperations and the correlations of performance metrics as operationalpatterns 120 to the augmentation component 154 for further processing.One example of software modules suitable for the analysis component 152is described in more detail below with reference to FIG. 3.

The augmentation component 154 can be configured to receive annotations118 and associate the received annotations 118 to correspondingoperations and/or correlations in the operational patterns 120. In oneembodiment, the annotation 118 can include a possible reason that cancause a violation of a sequence of operations in the operationalpatterns 120. For example, the annotation 118 can identify that anetwork traffic is a cause for a delay in queuing a received userrequest. In another embodiment, the annotation 118 can also include apossible reason that can cause a violation of a recognized correlationof performance metrics in the operational patterns 120. For example, theannotation 118 can identify that a possible cause for a continuousdecrease of available memory in light of a generally constant cache datasize is memory leakage. In further embodiments, the annotation 118 canalso include possible mitigation, remediation, or other suitable dataassociated with a violation of a sequence of operations or a correlationof performance metrics in the operational patterns 120. The augmentationcomponent 154 can be configured to combine the operational patterns 120with corresponding annotations 118 as the operational profiles 122 to bestored in the database 110 and/or provided to the interpretationcomponent 156.

In certain embodiments, the interpretation component 156 can beconfigured to receive the operational data 112 in real-time and monitoroperations of the tenant sites 142 or the computing fabric 104 on areal-time basis. In other embodiments, the interpretation component 156can also be configured to receive historical data 116 and analyze forpotential causes for operational issues. In further embodiments, theinterpretation component 156 can be configured to analyze theoperational data 112 and/or the historical data 116 in other suitablemanners.

In any of the foregoing embodiments, the interpretation component 156can be configured to determine one or more operational patterns from theoperational data 112 and/or the historical data 116. The interpretationcomponent 156 can then compare the determined operational patterns withcorresponding ones in the operational profiles 122. In response todetermining that an operational pattern is violated, the interpretationcomponent 156 can be configured to look up associated annotations 118 toprovide reasons, root-causes, and/or mitigation suggestions. In otherembodiments, the interpretation component 156 can also be configured tocalculate a health level of the tenant site 142 or the computing fabric104 based on a number of detected violations of the operationalpatterns, a total number of operations, and/or other suitableparameters. The interpretation component 156 can also receive reportedtenant issues 113 that include one or more operational issuesexperienced by a tenant 101 (FIG. 1). The interpretation component 156can then aggregate the tenant issues 113 over a period and compare theaggregated tenant issues 113 with the detected violations of theoperational patterns over the same period. The interpretation component156 can the provide reasons, root-causes, and/or mitigation suggestionsfor the reported tenant issues 113. One example of software modulessuitable for the interpretation component 156 is described in moredetail below with reference to FIG. 4.

FIG. 3 is a block diagram showing example software modules suitable forthe analysis component 152 of FIG. 2 in accordance with embodiments ofthe disclosed technology. As shown in FIG. 3, the analysis component 152can include an input module 160, a calculation module 166, a reportmodule 162, and a pattern module 164 operatively coupled to one another.Even though particular modules are shown in FIG. 3, in otherembodiments, the analysis component 152 can also include output,network, or other suitable types of modules.

The input module 160 can be configured to receive the operational data112, the historical data 116, and the user input 117. The input module160 can also be configured to recognize one or more events, issues,exceptions, states, performance metrics, or other suitable operationalconditions contained in the operational data 112 and/or the historicaldata 116. For example, in one embodiment, the input module 160 cangenerate the operational conditions based on a set of rules contained inthe user input 117. The set of condition rules can include one or morekeywords, strings, or combinations thereof. Example keywords or stringsinclude, for instance, “caching service stopped,” “failed to createcache instance,” “network timeout,” etc. One example condition rulerelated to cache operation event can be as follows:

<EventPattern>   <Pattern>Failed to create cache instance</Pattern>  <stateName>CacheInstanceIssue</stateName> </EventPattern>In the example above, a pattern for a failure to create a cache instancecan be recognized when a state name “CacheInstanceIssue” is recognizedin the operational data 112 and/or historical data 116. Based on the setof condition rules, the input module 160 can then scan the operationaldata 112 and/or the historical data 116 to generate a set of operationalfeatures with corresponding time stamps. In other embodiments, theforegoing functionalities can also be accomplished via machine learning,regular expressions, or other suitable techniques.

The input module 160 can also be configured recognize a transition ofsystem health from, for example, a healthy state to an unhealthy state,or vice versa, based on a set of health rules. The set of health rulescan include one or more health conditions. For instance, in oneembodiment, the following health rule illustrates a health conditionthat includes an event of cache service is started:

<HealthRule>   <HealthyStates>    <string>CacheServiceStarted</string>   <string>ThrottlingExited</string>   </HealthyStates> </HealthRule>If this health condition is met, the input module 160 can be configuredto recognize a transition of system healthy from an unhealthy state to ahealthy state. In another example, the input module 160 can indicate atransition from a healthy state to unhealthy state when a healthycondition of CPU being under a full load is met.

The input module 160 can further be configured to map certainperformance metrics to a system health state. For example, in oneembodiment, the input module 160 can indicate a transition from ahealthy state to an unhealthy state when an available memory size isless than a threshold (e.g., 50 MB); a number of memory page faults persecond exceeds another threshold (e.g., 600 per second), etc. In otherembodiments, the input module 160 can also map other performance metricsto other suitable system health states.

The calculation module 166 may include routines configured to performcertain types of calculations to facilitate operations of other modules.In one example, the calculation module 166 can include a counter thataccumulates a number of operational conditions or transition of healthstates. In another example, the calculation module 166 can include anaccumulation routine that calculates a duration of a persistentunhealthy state. In a further example, the calculation module 166 can beconfigured to compute a correlation coefficient between a pair ofperformance metrics. In further examples, the calculation module 166 caninclude linear regression, polynomial regression, interpolation,extrapolation, and/or other suitable subroutines.

The pattern module 164 can be configured to determine temporal sequencesof operational conditions and/or correlations of performance metrics. Inone embodiment, the pattern module 164 can recognize a sequence ofevents based on the processed operational data 112 and/or historicaldata 116 from the input module 160. One example routine (“TemporalRule”)for determining the temporal sequences can be as follows:

<TemporalRule>  <RuleEvents>  <a:string>Put</a:string> <a:string>ReplicationQueued</a:string>  <a:string>Pending</a:string> <a:string>ReplicationAcked</a:string>  </RuleEvents>  <TimeToNexEvent> <a:long>0</a:long>  <a:long>5</a:long>  <a:long>50</a:long> <a:long>100</a:long>  </TimeToNexEvent>  <ViolationClasses> <a:string>Connection$ NetworkBottlenecks </a:string> <a:string>ToomuchLoad$Contentions$GCIssues</a:string> <a:string>NetworkBottlenecks$WCFIssues</a:string>  <a:string>PutIssues$NetworkBottlenecks $Reconfiguration</a:string>  </ ViolationClasses></TemporalRule>The above example routine can be automatically derived from one or moresuccessful stress, function, or performance runs of a tenant site 142(FIG. 1) or the computing fabric 104 (FIG. 1). As shown above, the“RuleEvent” routine is configured to recognize a sequence of “Put,”“ReplicationQueued,” “Pending,” and “ReplicationAcked” events indicatedin the operational data 112 and/or the historical data 116. The“TimeToNexEvent” routine is configured to determine a time intervalbetween the foregoing events in, for example, milliseconds or seconds.The example above specifies that a time interval between “Put” to“ReplicationQueued” should be no more than 5 milliseconds. The“ViolationClasses” routine is configured to define certain classes ofviolations when the foregoing recognized sequence is violated.

In another embodiment, the pattern module 164 can be configured toindicate a correlation of pairs of performance metrics based on, forexample, the computed correlation coefficients from the calculationmodule 166. For instance, in one embodiment, the correlation module 162can indicate that an available memory size is inversely correlated to adata cache size based on a correlation coefficient approximately −1. Inanother example, the pattern module 164 can indicate that a networkutilization level is correlated with a number of service requests basedon a correlation coefficient of approximately 1. One example routine forcorrelating performance metrics can be as follows:

<Correlations>    <PerfCounter> Network Bandwidth Usage </PerfCounter>   <PerfCounter> Cache Bandwidth Usage </PerfCounter>    <PerfCounter>Average Secondary Response Time </PerfCounter>    <CorrelationValue>0.998 </CorrelationValue>   <ViolationClasses>  NetworkBottleNecks$ExternalProcessUsage   </ViolationClasses > </Correlations>As shown above, the example routine defines that the performance metrics“Network Bandwidth Usage,” “Cache Bandwidth Usage,” and “AverageSecondary Response Time” should be correlated with a correlationcoefficient values of 0.998 out of a range of (−1 to 1). If thiscorrelation is violated, the violation is associated with a violationclass “NetworkBottleNecks$ExternalProcessUsage.”

The pattern module 164 can then combine the sequences of operationalconditions and/or correlations of performance metrics into records ofoperational patterns 120 in an XML file, spreadsheet, or other suitabletypes of data file. The pattern module 164 can also be configured toprovide the operational patterns 120 to the augmentation component 154.

The augmentation component 154 can then associate the annotations 118with the operational patterns 120 to generate the operational profiles122. In one embodiment, each health rule can be associated withannotations 118 representing a violation class suggesting what a reasonfor a violation of the rule. The reason can be specific to a usersoftware application or generic to the distributed computing environmentin the computing fabric 104. For example, cache operations can havefailure reasons such as over eviction, put issues, memory cleanupissues, etc. Example generic reasons can include thrashing, system ispaging, low RAM, network throttling, etc. The example sequence above canbe associated with an annotation 118 as follows:

<a:string>ToomuchLoad$Contentions$GCIssues</a:string>

This foregoing annotation 118 indicates that if there is a violation ofthe example sequence above at “ReplicationQueued” (the second event inthe temporal sequence), then one of the reasons is too much load,contention, or garbage collection issue (“GCIssues”).

When a health rule is violated, a certain health state can be indicatedwith corresponding mitigation suggestions. For example, if a number ofmemory page faults exceeds a threshold, memory thrashing can beindicated, and a mitigation suggestion to avoid memory threshing is toincrease memory allocation. In other embodiments, each violation classcan be associated with a plurality of mitigation suggestions, which canbe provided to a detected health state based on ranking ofeffectiveness, costs, or other suitable criteria. For example, eachfailure reason above can be associated with a corrective operation,which can include a description of what a user to do and/or an input toan automated system (e.g., a fabric controller associated with thecomputing fabric 104) that takes corrective actions (e.g., increasingnetwork bandwidth limits, terminating unwanted applications, etc.).

The report module 162 can be configured to summarize issues found whenanalyzing the operational data 112 and/or the historical data 116. Thereport module 162 can aggregate recognized operating conditions basedon, for example, server side issues, client side issues, or based onother suitable criteria. For example, the report module 162 can beconfigured to show issues detected during a particular period, such as,for instance, a percentage of request timeouts, serializationexceptions, replication queue full, etc. In other embodiments, thereport module 162 can also provide a summary of the system healthconditions in the same period. For example, the report module 162 canidentify that crashes have been identified, network issues have beenencountered, CPU is under full load for a period of time, etc. Thereport module 162 can also identify when system health transitions fromhealthy to unhealthy or vice versa. For example, the report module 162can represent the system health as a state machine as follows:

-   -   High CPU usage from 10:10 to 10:15 PM; and    -   Partition movements happening from 10:13 to 10:20 PM.

Based on the output from the report module 162, an administrator oroperator can discover potential performance issues without searchingthrough a large of data of event logs.

FIG. 4 is a block diagram showing example software modules suitable forthe interpretation component 156 of FIG. 2 in accordance withembodiments of the disclosed technology. The interpretation component156 can be configured as an offline or online system. For example, incertain embodiments, the interpretation component 156 can be configuredas an offline system that receives and processes the operational data112. In other embodiments, the interpretation component 156 can also beconfigured as an online system that is a part of a user softwareapplication or a separate service running parallel of the user softwareapplication.

As shown in FIG. 4, the interpretation component 156 can include certainmodules that are generally similar in function and/or structure as thoseof the analysis component 152 in FIG. 3. As such, similar modules inFIG. 4 are identified with similar references. In certain embodiments,the interpretation component 156 can include an input module 160, acalculation module 166, an analysis module 172, and a control module 174operatively coupled to one another. In other embodiments, theinterpretation component 156 can also include other suitable modules andor routines.

In certain embodiments, the input module 160 and calculation module 166can cooperate to determine one or more of operational patterns and/orcorrelations of performance metrics based on the received operationaldata 112. The analysis module 172 can be configured to compare thedetermined operational patterns and/or correlations of the performancemetrics with corresponding ones in the operational profiles 122. Theanalysis module 172 can then determine if any violations of theoperational patterns and/or correlations exist. Based on the determinedviolations (if any), the analysis module 172 can identify the reasons ofsuch violations and providing guidance or suggestions of correctivemeasures based on the annotations 118 (FIG. 3) associated with theviolations.

For instance, in the example sequence discussed above with reference toFIG. 3 of (i.e., Put, ReplicationQueued, Pending, andReplicationCompleted) is violated because ReplicationCompleted is notseen. In addition, a violation of the correlation between networkbandwidth usage, cache bandwidth usage, and average secondary responseTime is also detected. Based on the foregoing violations, the analysismodule 172 can determine that a reason for these violations is likelydue to network bottlenecks. The analysis module 172 can then provide theresults of analysis to the control module 174, which is configured togenerate results 114 providing, for example, identification of theviolations and any suggestions of corrective actions. For instance, inthe foregoing example, the results 114 may suggest to decrease load orincrease network capacity.

In other embodiments, the analysis module 172 can also be configured toaggregate tenant issues 113 (e.g., request timeout, cache serverunavailable, etc.) over a period to generate an operational issuetimeline. The analysis module 172 can also be configured to aggregatethe observed violations over the same period to generate a system issuetimeline. The analysis module 172 can then align, juxtapose, or comparethe generated operational issue timeline with the system issue timelineto correlate observed operational issues with violations. Uponidentification of violations correlated to the operational issues, thediagnostic system 108 can be configured to determine a root-causerelated to the observed operational issues and/or provide mitigationsuggestions based on the annotations associated with the violations.

FIG. 5 is a flow diagram illustrating embodiments of a process 200 ofperforming operational diagnostics in accordance with embodiments of thedisclosed technology. Even though the process 200 is described belowwith reference to the computing framework 100 of FIG. 1 and the softwarecomponents of FIGS. 2-4, in other embodiments, the process 200 can beimplemented in other suitable computing systems, devices, or frameworks.

As shown in FIG. 5, the process 200 can include generating operationalpatterns based on operational data 112 and/or historical data 116(FIG. 1) at stage 202. In certain embodiments, the operational patternscan include temporal sequences of events. In other embodiments, theoperational patterns can also include time intervals between successiveevents in the temporal sequences. In further embodiments, theoperational patterns can also include correlations of two or moreperformance metrics of a computing system. Example operations forgenerating the operational patterns are described in more detail belowwith reference to FIG. 6.

As shown in FIG. 5, the process 200 can also include generatingoperational profiles at stage 204. The operating profiles can includethe operations patterns generated from stage 202 and associatedannotations received from a developer, an administrator, or othersuitable entities. The process 200 can the include interpretingoperational data based on the operational profiles at stage 206.Interpreting the operational data may be performed online or offlinefrom a corresponding computing system. Example operations forinterpreting the operational data are described in more detail belowwith reference to FIG. 7.

FIG. 6 is a flow diagram illustrating embodiments of a process 204 ofgenerating operational patterns in accordance with embodiments of thedisclosed technology. As shown in FIG. 6, the process 204 can includereceiving historical data at stage 210. The process 204 can then includeparsing the historical data at stage 212. Parsing the historical datacan be performed by, for example, identifying events, conditions,performance metrics based on user-provided rules, as described abovewith reference to FIGS. 2 and 3. The process 204 can then includerecognizing temporal sequences at stage 214 and correlating performancemetrics at stage 216, as described above with reference to FIGS. 2 and3. The process 204 can then include outputting the operational patternsat stage 218. The operational patterns can include the temporalsequences and/or correlations of performance metrics generated at stages214 and 216, respectively.

FIG. 7 is a flow diagram illustrating embodiments of a process 206 ofperforming interpretation of operational data in accordance withembodiments of the disclosed technology. As shown in FIG. 7, the process206 can include receiving operational data at stage 220. Receiving theoperational data can be on an online or offline basis. The process 206can then include determining a system health level at stage 222. In oneembodiment, determining the system health level includes determining oneor more violations of the operational patterns or correlations ofperformance metrics in the operational profiles. In other embodiments,determining the system health level can also include computing a rate ofviolation based on a number of operations with violations and a totalnumber of operations in a period of time.

The process 206 can then include correlating the system health levelwith reported tenant issues at stage 224. In one embodiment, the systemhealth level can be correlated with the tenant issues by comparing atimeline of the system health level with a timeline of the tenantissues. In other embodiments, the system health level can be correlatedwith the tenant issues by linear regression, manual comparison, and/orother suitable techniques. The process 206 can then include outputtingpossible causes and/or corrective suggestions for the tenant issues atstage 226. As described above with reference to FIGS. 1-4, the possiblecauses and/or corrective suggestions can be determined by looking upannotations corresponding to the detected violations.

FIG. 8 is a schematic diagram illustrating an example operationalpattern 300 of a computing system under normal operation conditions inaccordance with embodiments of the disclosed technology. As shown inFIG. 8, the operational pattern 300 can include one or more sequences ofoperations, events, or states. In the illustrated embodiment, theoperational pattern 300 can include a first sequence having a Putoperation 302, a Queued operation 304, and a Pending state 306. Theoperational pattern 300 can also include a second sequence having thePut operation 302, the Queued operation 304, a replication request(Repl_Req) 310, a replication complete state 312, a committed state 308,and an acknowledge (ACK) 316. The operational pattern 300 can alsoinclude one or more time intervals between pairs of the operations orstates. For instance, as shown in FIG. 8, a time interval between thePut operation 302 and the Pending state 306 is 5 milliseconds. Anothertime interval between the Put operation 302 and the Committed state 308is 50 milliseconds for a payload with a size up to 100 KB. As describedin more detail below with reference to FIG. 10, a violation of thesequences or one or more time intervals of the sequences can beassociated with one or more annotations.

FIG. 9 is a schematic diagram illustrating a graph 400 showing exampleperformance metrics in accordance with embodiments of the disclosedtechnology. As shown in FIG. 9, the example graph 400 shows a plot ofavailable memory, cache data size, network utilization, and servicerequest metrics over time. As discussed in more detail with reference toFIGS. 2 and 3, two or more of the performance metrics may be correlatedwith one another. For example, the available memory appears to beinversely correlated with the cache data size. The service requestmetric appears to be correlated with network utilization.

FIG. 10 is a schematic diagram illustrating an example operationalpattern with augmented annotations in accordance with embodiments of thedisclosed technology. As shown in FIG. 10, one or more potentialreasons, causes, or corrective suggestions can be associated with aviolation of the sequences. For example, if a Put operation 302 is notfollowed by a Queued operation 304, an annotation can be associated withthis condition to indicate that possible causes can include too muchload contentions in the network. In another example, if a Committedoperation 308 is not followed by an acknowledge 316, another annotationcan be associated with this condition to indicate that a possible causeis an issue with the Put operation and a corrective suggestion is tomodify configuration of the Put operation.

FIGS. 11A-11C are schematic diagrams illustrating an example interfacefor correlation of operational issues with system health levels inaccordance with embodiments of the disclosed technology. As shown inFIG. 11A, system health levels can be aggregated and plotted on atimeline as blocks or other suitable representations. Example healthlevels shown in FIG. 11A include network throttle and CPU crash. Theaggregated system health levels can also be expanded to show details ofsystem profiles and corresponding severity. As shown in FIG. 11B,operational issues such as those experienced by tenants 101 (FIG. 1) canalso be aggregated and plotted on a timeline. Similarly, the operationalissues can also be expanded to show more detail and correspondingseverity. As shown in FIG. 11C, the two timelines in FIGS. 11A and 11Bcan be aligned, juxtaposed, or otherwise compared to correlateoperational issues with system health levels. As described in moredetail above with reference to FIGS. 1-4, based on such comparison,possible causes or reasons for the operational issues and correctivesuggestion may be provided.

FIG. 12 is a computing device 800 suitable for certain components of thecomputing framework 100 in FIG. 1. For example, the computing device 800may be suitable for the client devices 102, the servers 106, or thediagnostic system 108 of FIG. 1. In a very basic configuration 802,computing device 800 typically includes one or more processors 804 and asystem memory 806. A memory bus 808 may be used for communicatingbetween processor 804 and system memory 806.

Depending on the desired configuration, the processor 804 may be of anytype including but not limited to a microprocessor (μP), amicrocontroller (μC), a digital signal processor (DSP), or anycombination thereof. The processor 804 may include one more levels ofcaching, such as a level one cache 810 and a level two cache 812, aprocessor core 814, and registers 816. An example processor core 814 mayinclude an arithmetic logic unit (ALU), a floating point unit (FPU), adigital signal processing core (DSP Core), or any combination thereof.An example memory controller 818 may also be used with processor 804, orin some implementations memory controller 818 may be an internal part ofprocessor 804.

Depending on the desired configuration, the system memory 806 may be ofany type including but not limited to volatile memory (such as RAM),non-volatile memory (such as ROM, flash memory, etc.) or any combinationthereof. The system memory 806 may include an operating system 820, oneor more applications 822, and program data 824. The program data 824 mayinclude, for example, the operational profiles 122 s. This describedbasic configuration 802 is illustrated in FIG. 8 by those componentswithin the inner dashed line.

The computing device 800 may have additional features or functionality,and additional interfaces to facilitate communications between basicconfiguration 802 and any other devices and interfaces. For example, abus/interface controller 830 may be used to facilitate communicationsbetween the basic configuration 802 and one or more data storage devices832 via a storage interface bus 834. The data storage devices 832 may beremovable storage devices 836, non-removable storage devices 838, or acombination thereof. Examples of removable storage and non-removablestorage devices include magnetic disk devices such as flexible diskdrives and hard-disk drives (HDD), optical disk drives such as compactdisk (CD) drives or digital versatile disk (DVD) drives, solid statedrives (SSD), and tape drives to name a few. Example computer storagemedia may include volatile and nonvolatile, removable and non-removablemedia implemented in any method or technology for storage ofinformation, such as computer readable instructions, data structures,program modules, or other data.

The system memory 806, removable storage devices 836, and non-removablestorage devices 838 are examples of computer readable storage media.Computer readable storage media include storage hardware or device(s),examples of which include, but not limited to, RAM, ROM, EEPROM, flashmemory or other memory technology, CD-ROM, digital versatile disks (DVD)or other optical storage, magnetic cassettes, magnetic tape, magneticdisk storage or other magnetic storage devices, or any other media whichmay be used to store the desired information and which may be accessedby computing device 800. Any such computer readable storage media may bea part of computing device 800. The term “computer readable storagemedium” excludes propagated signals and communication media.

The computing device 800 may also include an interface bus 840 forfacilitating communication from various interface devices (e.g., outputdevices 842, peripheral interfaces 844, and communication devices 846)to the basic configuration 802 via bus/interface controller 830. Exampleoutput devices 842 include a graphics processing unit 848 and an audioprocessing unit 850, which may be configured to communicate to variousexternal devices such as a display or speakers via one or more A/V ports852. Example peripheral interfaces 844 include a serial interfacecontroller 854 or a parallel interface controller 856, which may beconfigured to communicate with external devices such as input devices(e.g., keyboard, mouse, pen, voice input device, touch input device,etc.) or other peripheral devices (e.g., printer, scanner, etc.) via oneor more I/O ports 858. An example communication device 846 includes anetwork controller 860, which may be arranged to facilitatecommunications with one or more other computing devices 862 over anetwork communication link via one or more communication ports 864.

The network communication link may be one example of a communicationmedia. Communication media may typically be embodied by computerreadable instructions, data structures, program modules, or other datain a modulated data signal, such as a carrier wave or other transportmechanism, and may include any information delivery media. A “modulateddata signal” may be a signal that has one or more of its characteristicsset or changed in such a manner as to encode information in the signal.By way of example, and not limitation, communication media may includewired media such as a wired network or direct-wired connection, andwireless media such as acoustic, radio frequency (RF), microwave,infrared (IR) and other wireless media. The term computer readable mediaas used herein may include both storage media and communication media.

The computing device 800 may be implemented as a portion of a small-formfactor portable (or mobile) electronic device such as a cell phone, apersonal data assistant (PDA), a personal media player device, awireless web-watch device, a personal headset device, an applicationspecific device, or a hybrid device that include any of the abovefunctions. The computing device 800 may also be implemented as apersonal computer including both laptop computer and non-laptop computerconfigurations.

Specific embodiments of the technology have been described above forpurposes of illustration. However, various modifications may be madewithout deviating from the foregoing disclosure. In addition, many ofthe elements of one embodiment may be combined with other embodiments inaddition to or in lieu of the elements of the other embodiments.Accordingly, the technology is not limited except as by the appendedclaims.

1-20. (canceled)
 21. A diagnostic system for diagnosing performance of amonitored computing system, comprising: a processor; and a memoryoperatively coupled to the processor, the memory storingcomputer-executable instructions executable by the processor to causethe remote diagnostic system to: receive operational data from ananalyzed computing system, the operational data representing one or moreof operations, events, or system states related to the computing system;identify an operational pattern based on the operational data, theoperational pattern including a temporal sequence of the operations,events, or system states related to the analyzed computing system; andgenerate data representing an operational profile of the computingsystem by associating an annotation with the identified operationalpattern, the annotation identifying a reason, a cause, or a correctivesuggestion corresponding to a violation of the operational pattern,wherein the operational profile includes the identified operationalpattern and the associated annotation, and wherein the operationalprofile allows the annotation to be provided to identify a reason, acause, or a corrective suggestion corresponding to a violation of thetemporal sequence in the associated operational pattern.
 22. Thediagnostic system of claim 21 wherein the received operational data fromthe analyzed computing system includes operational data from theanalyzed computing system operating under normal conditions.
 23. Thediagnostic system of claim 21 wherein the received operational data fromthe analyzed computing system includes event logs from the analyzedcomputing system operating under normal conditions.
 24. The diagnosticsystem of claim 21 wherein: the received operational data from theanalyzed computing system includes event logs from the analyzedcomputing system operating under normal conditions; and the memorycomprises additional instructions executable by the processor to causethe diagnostic system to: parse the event logs; and identify a temporalsequence of events based on the parsed event logs.
 25. The diagnosticsystem of claim 21, wherein: the received operational data from theanalyzed computing system includes event logs from the analyzedcomputing system operating under normal conditions; and the memorycomprises additional instructions executable by the processor to causethe diagnostic system to: parse the event logs; identify a temporalsequence of events based on the parsed event logs; and identify a timeinterval between a pair of the events of the temporal sequence.
 26. Thediagnostic system of claim 21, wherein: the received operational datafrom the analyzed computing system includes event logs from the analyzedcomputing system operating under normal conditions; and the memorycomprises additional instructions executable by the processor to causethe diagnostic system to: parse the event logs; identify a temporalsequence of events based on the parsed event logs; identify a timeinterval between a pair of the events of the temporal sequence; andassociate the received annotation with a condition for which the timeinterval between the pair of the events of the temporal sequence isexceeded.
 27. The diagnostic system of claim 21 wherein: the annotationis a first annotation; and the memory comprises additional instructionsexecutable by the processor to cause the diagnostic system to: identifya correlation of performance metrics of the computing system, theperformance metrics individually including an operating parametercorresponding to a performance level of the analyzed computing system;and receive and associate a second annotation with the correlation ofperformance metrics, the second annotation identifying a reason, acause, or a corrective suggestion corresponding to a violation of thecorrelation of the performance metrics.
 28. A method of diagnosingcomputing system performance, comprising: receiving operational datafrom an analyzed computing system; identifying an operational patternbased on the operational data from the analyzed computing system, theoperational pattern including a temporal sequence of operations, events,or system states related to the analyzed computing system; generatingdata representing an operational profile of the computing system byassociating an annotation with the identified operational pattern, theannotation identifying a reason, a cause, or a corrective suggestioncorresponding to a violation of the temporal sequence; and providing, toa diagnostic computing system, the generated operational profile fordiagnosing performance of the analyzed computing system based onadditional operational data from the computing system, wherein theprovided operational profile allows the diagnostic computing system toprovide the annotation to identify a reason, a cause, or a correctivesuggestion corresponding to a violation of the temporal sequence in theassociated operational pattern.
 29. The method of claim 28 whereinreceiving the operational data from the analyzed computing systemincludes receiving operational data from the analyzed computing systemoperating under normal conditions.
 30. The method of claim 28 whereinreceiving the operational data from the analyzed computing systemincludes receiving event logs from the analyzed computing systemoperating under normal conditions.
 31. The method of claim 28 wherein:receiving the operational data from the analyzed computing systemincludes receiving event logs from the analyzed computing systemoperating under normal conditions; and identifying the operationalpattern includes: parsing the event logs based on keywords; andidentifying a temporal sequence of events based on the parsed eventlogs.
 32. The method of claim 28 wherein: receiving the operational datafrom the analyzed computing system includes receiving event logs fromthe analyzed computing system operating under normal conditions; andidentifying the operational pattern includes: parsing the event logsbased on keywords; identifying a temporal sequence of events based onthe parsed event logs; and identifying a time interval between a pair ofthe events of the temporal sequence.
 33. The method of claim 28 wherein:receiving the operational data from the analyzed computing systemincludes receiving event logs from the analyzed computing systemoperating under normal conditions; identifying the operational patternincludes: parsing the event logs based on keywords; identifying atemporal sequence of events based on the parsed event logs; andidentifying a time interval between a pair of the events of the temporalsequence; and associating the received annotation includes associatingthe received annotation with a condition for which the time intervalbetween the pair of the events of the temporal sequence is exceeded. 34.The method of claim 28 wherein: the annotation is a first annotation;and the method further includes: identifying a correlation ofperformance metrics of the analyzed computing system, the performancemetrics individually including an operating parameter corresponding to aperformance level of the computing system; and receiving a secondannotation and associating the second annotation with the correlation ofperformance metrics, the second annotation identifying a reason, acause, or a corrective suggestion corresponding to a violation of thecorrelation of the performance metrics.
 35. The method of claim 28,further comprising: receiving additional operational data from theanalyzed computing system; identifying another operational pattern basedon the additional operational data; and updating the association of thereceived annotation with the identified another operational pattern. 36.A method of diagnosing computing system performance, comprising:receiving operational data from a computing system; identifying anoperational pattern based on the received operational data, theoperational pattern including a temporal sequence of operations, events,or system states of the computing system; determining whether theidentified operational pattern violates an operational profile bycomparing the identified operational pattern with a referenceoperational pattern of the operational profile; and in response todetermining that the identified operational pattern violates thereference operational pattern of the operational profile, outputting,via a device remote from the computing system, a reason, cause, orcorrective suggestion contained in an annotation associated with thereference operational sequence in the operational profile for diagnosingperformance of the computing system.
 37. The method of claim 36 wherein:receiving the operational data includes receiving event logs from thecomputing system; and identifying the operational pattern includes:parsing the event logs based on keywords; and identifying a temporalsequence of events based on the parsed event logs.
 38. The method ofclaim 36 wherein: receiving the operational data includes receivingevent logs from the computing system operating; and identifying theoperational pattern includes: parsing the event logs based on keywords;identifying a temporal sequence of events based on the parsed eventlogs; and identifying a time interval between a pair of the events ofthe temporal sequence.
 39. The method of claim 36 wherein: theannotation is a first annotation; and the method further includes:identifying a correlation of performance metrics of the computingsystem, the performance metrics individually including an operatingparameter corresponding to a performance level of the computing system;determine whether the identified correlation of performance metricsviolates a reference correlation of performance metrics associated witha second annotation identifying a reason, a cause, or a correctivesuggestion corresponding to a violation of the correlation ofperformance metrics; and in response to determining that the identifiedcorrelation of performance metrics violates the reference correlation ofperformance metrics, outputting the reason, cause, or correctivesuggestion contained in the second annotation for diagnosing performanceof the computing system.
 40. The method of claim 36, further comprising:receiving an operational issue of the computing system from a tenant ofthe computing system; determining if a timeline of the operational issuecorrelates with a timeline of the violation of the operational pattern;and in response to determining that the timeline of the operationalissue correlates with the timeline of the violation of the operationalpattern, outputting the reason, cause, or corrective suggestioncontained in the annotation as related to the received operationalissue.